British academy Researchers at Risk career development programme surveys Privacy Notice

This data collection process is being managed by Vitae (part of the Careers Research & Advisory Centre (CRAC)) on behalf of British Academy.

1.  Introduction

The Careers Research and Advisory Centre (CRAC) Ltd is the non-profit organisation that manages the Vitae programme.  Vitae is the global leader in supporting the professional development of researchers, experienced in working with institutions as they strive for research excellence, innovation and impact.  You can find more information about CRAC and the work that we do on our website: www.crac.org.uk.  

CRAC is committed to protecting the personal information of all its contacts and being clear about what information we hold about them and how we use it. This privacy notice tells you what to expect when CRAC collects personal information.  

CRAC is registered as a data controller with the Information Commissioner’s Office (ICO). Our registration number is Z1030346.  You can check our registered details on the ICO’s website: https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/  

2.  Data controller and Data Protection Officer

For the purposes of the surveys connected to the British Academy Researcher at Risk career development programme which CRAC has been contracted to deliver, British Academy is the data controller, and CRAC is the data processor of any personal information collected within scope of this programme.  The contact details of British Academy Data Protection Officer are:

Paul Sanders - DPO@thebritishacademy.ac.uk

CRAC’s Data Protection Officer (DPO) is: 

David Nightingale 
IT Manager
The Careers Research and Advisory Centre (CRAC) Limited
22 Signet Court
Cambridge
CB5 8LA
Email: david.nightingale@crac.org.uk
Tel: 01223 460277

3.  How we use your information

The specific uses that will be made of your personal information are listed below: 

  • Your responses will be used to inform the level of interest in, and appropriate type and content for current and future researcher development training programmes for Researchers at Risk. 

  • Your responses may be used after any training interventions to determine the impact of the training.  

  • Your responses will be kept confidential and not shared with any third parties other than the programme organisers at British Academy (in anonymised form only).  

  • If you choose to provide your email address this will be used to inform the British Academy of those survey participants interested in taking a more active role in the programme. They will not be linked to responses to other questions. You do not need to provide your email address.  

  • If we want to use your personal information for a reason other than the purposes set out above, we will tell you before we start that use.

4. The legal basis for processing your information

Under data protection legislation, we require a legal basis to be able to process personal information for the purposes set out above. In this case, the legal basis is: Consent.

We will never sell or share this information with other parties or use for other purposes without informing you first. We may ask for your consent to use anonymous quotes from your feedback to promote our events. Consent can be withdrawn at any time by emailing dataprotection@vitae.ac.uk with your request.

5. What personal information we will collect

We may collect: 

  • Email address

  • Level of research experience

  • Career stage

  • Discipline area

  • Gender

  • Nationality

The Data Processor has identified that no risky processing will be undertaken in respect of the personal data collected and implemented the measures described in Section 9 below to protect your personal data.

6. Personal information we obtain from another source 

We do not expect to obtain any personal information from any other source.

7. Who we give your personal information to 

The survey asks for an email address if you are interested in playing a more active role in the wider development programme by joining a learning and development committee. We will pass email addresses submitted in this way to the British Academy and Vitae will contact you to discuss that opportunity further. Emails provided in this way will not be connected to your other responses.

The information regarding level of research experience, career stage, discipline area, gender, and nationality, will be shared in aggregated form with the British Academy, the learning and development committee as well as the Vitae facilitators. 

We will not routinely pass your information to any other organisation except where required to do so as part of our functions or by law.

8. Where your personal information will be stored

Your personal information is stored on Microsoft Azure and Microsoft Office 365 business services.  Microsoft will have access to your personal information for the purposes of providing the business services to us. For more information about how Microsoft may process your personal information please see the information in the Microsoft Trust Centre: www.microsoft.com/en-us/trustcenter/privacy. 

CRAC uses Surveymonkey to distribute surveys and collect responses.  For more information on how Surveymonkey handles data, please visit Privacy Notice | Momentive (surveymonkey.com) Like many other online providers, Surveymonkey is a US-based service provider. Like others, it is certified under the EU-U.S. Privacy Shield, so that the legal requirements for an adequate level of data protection are met.

We do everything possible to protect your and our data and to ensure transparency. However, it is up to you to decide whether you want to or are allowed to participate via Surveymonkey. With your participation in a Surveymonkey survey you accept the data privacy policy and agree to the processing of the data necessary for the execution of the programme.

You should understand and agree that your personal information may be transferred to, and stored at, a destination outside the country and economic area in which you reside, and that it may also be processed by staff operating outside that country for the purposes set out in this Privacy Policy.

9. How we protect your personal information

The Data Processor has security measures in place to protect your personal information, listed below: 

  • All staff are required to undertake training in data protection and information security on joining CRAC and then on an annual basis.

  • Formal information security policies that must be read and understood by all staff who sign an agreement to process data in accordance with specified policies.

  • Personal information is only available to those members of staff who require access as part of their role.

  • All personal data will be encrypted when stored.

  • All personal data will be encrypted when transferred between the Data Processor and the Data Controller.

  • Your personal data will be processed in accordance with written instructions provided by the Data Controller and will be deleted from the Data Processor systems once the specified processing period has been completed.

  • We work with third-party data processors that have committed to full General Data Protection Regulations (GDPR) compliance: https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/default.aspx

  • CRAC currently has Cyber Essentials and ISO 27001 certification.

10. Your rights over your personal information

Once your personal information has been collected, you have certain rights in relation to that personal information that may be exercised. You have the right to:

  • Ask for a copy of your personal information

  • Correct inaccurate personal information held about you

  • Restrict processing of your personal information

  • Ask for a copy of your information in a format that allows easy transfer (“data portability”)

  • Object to automated decision making or profiling (if these take place)

  • Where consent is the legal basis for collecting the information, you have the right to withdraw consent by emailing dataprotection@vitae.ac.uk and requesting your personal data is deleted.

Further information about your data protection rights appears on the Information Commissioner’s website at https://ico.org.uk/for-organisations/guide-to-data-protection/principle-6-rights/

11. How long we will hold your personal information

We will only keep personal data for as long as it is needed for the purpose(s) of this programme, after which point it will be securely destroyed. Personal data will be retained for six months after completion of the project, which is currently scheduled to be 31 March 2025 but may be extended. Please note that, under Data Protection legislation, and in compliance with the relevant data processing conditions, personal data can be kept for longer periods of time when processed purely for archiving purposes in the public interest, scientific or historical research, and statistical purposes.

12.  Complaints about the use of your personal information

If you are unhappy with the way in which your personal information has been handled by CRAC, you may contact us at: dataprotection@crac.org.uk or via our Data Protection Officer (details in section 2) and we will try to resolve your issue informally.

If we have are not able to resolve the issue to your satisfaction, you can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) and they can be contacted at:  

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Email: casework@ico.org.uk

13. Changes to this privacy notice

We may need to update this privacy notice periodically, so we recommend that you revisit this information from time to time.  This version was last updated on 4 December 2023.

Bookmark & Share